fix: V-model pilot — scaffold scripts/vmodel/ + close 9 of 12 rivet validate errors

[avrabe]

Summary

• Scaffolds scripts/vmodel/ — a four-prompt V-model gap-hunt pipeline (rank/discover/validate/emit + HOWTO), modeled on Mythos but targeting traceability completeness instead of code bugs
• discover.md prefers rivet query --sexpr as the primary enumeration tool over hand-rolled JSON parsing; documents the DSL gap I hit and links s-expr DSL: no clean way to express 'artifact missing outbound link of type X', and linked-* operator semantics need docs rivet#190
• Pilot run on sigil's 12 rivet validate errors closes 9 of 12:
  • AS-35 → exploits → UCA-34 (high-confidence link-existing — sister scenarios AS-31/32 already use this pattern)
  • AS-36 → exploits → UCA-14 + DF-12 (high-confidence link-existing — UCA-14 already shares H-14 with AS-36)
  • AS-34 → exploits → UCA-36 + DF-19 with new draft UCA-36 ("Insert proof into cache APPLIED TOO LONG without max-entries bound", linked to CTRL-4 + H-36) — medium-confidence create-and-link, UCA-36 needs human review
• Sigil-local error count: 12 → 3 (75% reduction)

Methodology

This PR is the first end-to-end V-model gap-hunt cycle: rank → discover (5 parallel agents in fresh sessions) → validate (mechanical via rivet validate) → emit (via rivet link / rivet add). Each agent investigated one root-cause cluster of the 12 errors. Key meta-finding: 110 of the 114 broken cross-refs are not sigil bugs but synth-authored references that sigil sees by walking the synth external during validate — those need coordinated work in synth + externals config in sigil, tracked separately.

What's NOT in this PR

• Out of scope: 3 remaining sigil-local errors — pre-existing related-to undefined-link-type errors on H-36/37/38. Different gap class (schema definition, not missing link). Should be a separate fix.
• Out of scope: 78 broken local CC/H/SC ID series + 35 UnknownPrefix refs — root cause is in synth, not sigil. Discovery agents traced this; closing requires coordinated work across repos.
• Out of scope: pre-release Mythos-style V-model gate — could be added to AGENTS.md once the pipeline has cycled a few more times. Defer.

UCA-36 — needs reviewer attention

`UCA-36` is the only new artifact in this PR. The discovery agent flagged it as medium confidence:

A reviewer should confirm (a) that a resource-bound UCA on CTRL-4 is preferred over extending UCA-10 to cover cache insertion, and (b) that linking DF-19 as a secondary `exploits` target is wanted — AS-7 (the closest pure-DoS analogue) links a UCA only.

Reviewer: please check the UCA-36 draft text in `artifacts/stpa/ucas.yaml`. If the framing is wrong, the alternative is to extend UCA-10 instead (and remove UCA-36).

Test plan

• CI passes on `rust.yml` (cargo test confirmed locally — 729 pass, 0 failures)
• CI passes on `wasm-signing.yml`
• `fuzz.yml` and `memory.yml` pass
• `rivet validate` shows ≤ 3 sigil-local errors (down from 12; the 3 remaining are out of scope)
• Reviewer confirms or rejects UCA-36's framing (resource-bound UCA on CTRL-4 vs. extension of UCA-10)

Linked

• Related rivet ergonomics issue: s-expr DSL: no clean way to express 'artifact missing outbound link of type X', and linked-* operator semantics need docs rivet#190 (s-expr DSL gap)
• Mythos pipeline that this V-model variant complements: PR chore: add Mythos bug-hunt pipeline + AGENTS.md restructure #86 (scaffolding) and fix: AS-37 — reject malformed cert_count in SignatureForHashes::deserialize #87 (first finding)

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!